New answers tagged http
1
In this day and age, plain HTTP should not be used at all. Period.
This may be a radical standpoint, but all the reasons that have been stated over the years just don't matter anymore. There is just no good reason to not use HTTPS.
I don't do anything confidential, so my site doesn't need HTTPS.
Any attacker with Man-in-the-Middle capabilities can ...
0
By clicking on links inside an email you're actually doing a HTTP GET request. Probably before sending this phishing mail to you they (who create phoshing sites) automatically added some identifier to that link to be able to check later who got an email and who clicked on that link, when and from which IP and from which browser, etc. So they can identify you....
0
Remember that crime is now commoditised and supported by a large framework of services. Any single email you receive might be part of a dozen different criminal services.
So, what is happening exactly here is not going to be known without access to the services used. We can only speculate.
The first hop is the easiest to guess. SOME_LETTERS_AND_NUMBERS is ...
4
You used "security through obscurity" in quotes, so I don't think I need to convince you that that is not going to work.
To achieve your goals, you will need to encrypt the connection between the clients connecting and the server (with a logon). HTTPS is the simplest, lowest effort, and cheapest way to do that.
But you can also consider things like ...
0
Isn't it a threat that anyone can see my secure website?
TLS was designed to protect the application payload. It was not designed to protect the meta information of the connection, i.e. the domain name, source and target IP address, number of bytes transmitted, timing of traffic etc. There can definitely be a privacy risk when somebody is getting these ...
0
A common security flaw is logging plaintext passwords by mistake:
Twitter
Facebook
Google
Robinhood
Elsevier
Even if you have transport security, it has advantages to not have the plaintext password on your server. Transport security protects against attackers. If you want to protect yourself against your own mistakes, you need client side hashing.
0
HTTPS does not prevent DNS spoofing, since these two protocols work at different layers and in fact HTTPS, because of the X.509 certificates that underline the Web PKI, need the DNS (both at certificate issuance time and also at client verification time), while the DNS does not need HTTPS to work (of course when you do not use it explicitly like with the ...
1
Asymmetric private keys have two basic operations: they can Sign a message such that anybody with the corresponding public key can verify that the private-key-holder signed it and it hasn't been tampered with, and they can Decrypt a message that was encrypted using the public key. In addition to the direct usefulness of these operations, the private key can ...
0
The private key is part of a key pair: a public key and private key that belong to each other. The certificate contains the public key. The client encrypts data using the public key and sends it to the server. The server can only decrypt it if it has the corresponding private key. If the connection is set up correctly, this is proof that the server owns the ...
1
what are the security risks?
The security risk is that there is no security at all to begin with.There is a reason why authentication exists.
Now lets assume that GUID is sufficiently long enough such that brute force is out of the question.But it still gets logged in so many places.
But the real threat is more from powerful crawlers that search engines ...
Top 50 recent answers are included
